Exhibit A 



PATENT PROPOSAL FORM 



The purpose of this form is to gather information on potentially patentable technologies 
developed at Symantec and useful in its business. For any answer that requires more space than is 
provided, feel free to write additional information at the end of the form or on attached separate 
sheets or documents. 

1. INVENTOR(S): (list the persons that participated in the development of the 
product/technology proposed to be patented): 

A. Name Shaun Co ol ey Citizenship USA 

Home 
Phone 




2. NAME OF MANAGER: Javed Khan 



3. TITLE OF INVENTION: 

Method for Detecting Nearly Invisible Text in Spam 

4. CONCEPTION OF INVENTION: (provide whatever information is available): 

A. Date of Conception, 

B. Date of First Writte _ 

Eng. Notebook No. ^ T>age (s) 

C. Date of First Oral Disclosure N/A 




5. CONSTRUCTION AND TEST OF PRODUCT/TECHNOLOGY: (information regarding 
implementation of the product/technology; this does not have to be the full commercial version: 
provide information regarding the first or very early implementations that substantially 
accomplish the intended result)^^^^^^^^ 

A. Date Completed _j[^^^^^^L_ Build No. 

B. By Whom Made 

C. Date of First Successful Test 

D. Location of Code- 



E. Has First Successful Version Been Retained? 

F. Anticipated Product: ■ 



Yes 



6. INVENTION RELATES TO: 

This invention relates to improvements in spam detection by detecting an increasingly common 
trick used by spammers. 

8. LIST OF PRIOR ART: (related printed publications, patents, reference materials or sources 
that you are aware of that describe prior art or form a basis for the product/technology proposed 
to be patented): 



9. OBJECT OF INVENTION: (describe what new features, improvements over existing 
products/technology, or other advantages exist in the product/technology proposed to be 
patented as compared to the prior art described above): 

Current statistical spam detection techniques are easily tricked in to believing that a message is 
not spam. If the sender of a spam message includes a large body of seemingly legitimate text, 
giving the text close to the same color as the background of the document, the legitimate words 
are still included in the statistical analysis. When this trick is used by a spammer, the spam 
message is typically 10-20 words long, while the legitimate text, included in the message, is 
typically 1000-2000 words long. Since the legitimate text is usually 100-200 times larger, the 
spam words have little influence on the final outcome of the statistical analysis. 

10. BRIEF DESCRIPTION: (provide a brief description of the product/technology proposed to 
be patented, stressing the fundamental principles of the new idea from an engineering 
standpoint): 

As previously discussed this invention enables a spam detection engine to recognize camouflaged 
text in the body of an email. The following components are required to accomplish this task: 

1 . An HTML parser that is capable of recognizing all methods of changing the foreground 
and background color in HTML. This includes, but is not limited to: style sheets, color 
attributes, background attributes, and inline styles. 

2. A color comparison engine, capable of deciding if two colors are close enough to each 
other to make text unreadable. 

3. A spam detection engine. 

When an HTML email is to be classified by the spam detection engine, it is first passed through 
an HTML parser. The HTML parser tracks the foreground and background colors of text, 
throughout the document. When the foreground or background color changes, the difference in 
the two colors is calculated. If the difference in colors is deemed to be negligent, all text that uses 
the offending colors will be removed. When the HTML parser finishes removing camouflaged 
sections, the email continues on to the spam detection engine for processing. 

jjjj^B^^^^^^^lS^Si^U the color differences are calculated as follows: 

1 . Foreground (fg) and background (bg) colors are converted from Red/Green/Blue (RGB - 
each value is in the range of 0-255) values to Hue/Saturation/Brightness (HSB - Hue is 
measured in degrees and thus has a range of 0-359, where 0 and 360 would be the same 
value; brightness and saturation are measured in percentages and have values of 0-100) 
values. 

2. The differences between the fg and bg colors are calculated. 

a. Gray-Scale Values 



i. Since hue makes no difference in gray-scale colors, only the saturation and 
brightness are compared. 

ii. If the saturation difference is less than 6 and the brightness difference is 
less than 4, the fg color is deemed invisible. 

b. Color Values 

i. If the hue difference is less than 6 and combined brightness and saturation 
difference is less than 14, the fg color is deemed invisible. 



11. ALTERNATIVE EMBODIMENT(S), if any: (i.e., other ways that the same results could 
be accomplished, if you are aware of or have implemented any): 



12. PUBLICATION: 

A. Has a description of the product/technology been published? 
Yes No x 

If Yes, Date of Publication 

Title 

B. Anticipated Publication 

Yes No 

If Yes, Date of Publication . 

Title 

13. SALE: 

A. Was the product/technology ever offered for sale or sold? 
Yes No x 

If Yes, Date of First Offer/Sale 

B. Anticipated Sale 

Yes No x 

If Yes, Date 

14. OTHERS IN THE COMPANY FAMILIAR WITH PRIOR ART: (list the names of a 
few people in the Company that you feel are experts in the area of the product/technology 
proposed to be patented that may be able to provide additional information regarding similar 
products/technologies, related products/technologies and/or predecessors to the 
product/technology proposed to be patented): 



15. FLOWCHARTS, PSEUDOCODE FOR SOFTWARE/PROCESS INVENTIONS: (If 

available, insert below, provide on a separate sheet or attach as a separate document) 



